KeePassX

KeePassX has been a very popular and famous password manager for Linux for a very long time and still trusted by pretty big number of users. When user launches the KeePassX password manager first it requires to set up of a master password to add an extra layer of security to password storage. As an option you can use a file with encryption key instead of the password. This key file can be used along with the master password to provide stronger security. KeePassX application is rather simple so you can easily create one or more databases which will have a master password and will contain all the login credentials stored encrypted. This manager is considered to be one of the most secure managers. If you’re Ubuntu user just type in terminal the following command:

sudo apt-get install keepassx

GPassword Manager

Gpassword Manager (GPM) is also one of the most secure and highly rated password managers which have more friendly and easy to use interface that KeePassX. This utility has many features that make it to be a good choice for most of the high level computer users. This password manager allows to set and add favorites into system-tray that is one of the unique features of this application. GPM utility uses the crypto++ method for encryption which can be used in Windows and Linux hence it enables the same database to be used on different platforms without the need to convert anything.

My Passwords

My Passwords is a simple and easy to use utility that allows you to store all your login credentials in an encrypted manner within a file. The most exciting feature of this utility are its speed and no requirement of an installation. Encryption algorithm that is used there is AES. Storage in Derby Database format along with AES encryption gives the user the power to create secure and fast password repository. The interface for this utility is fairly simple.

Fiagaro’s Password Manager 2

Fiagaro’s Password Manager 2 is another powerful tool with strong encryption methods that makes it one of the most secure utility for managing passwords in Linux. Fiagaro’s Password Manager 2 uses the AES-256 encryption of the database files which hold all your login credentials (it uses master password that should be set up once you started the program first).

Gringotts

Gringotts is rather old project: its application for Linux/Unix provides the user the possibility to store his or her notes in secure storage encrypted by symmetrical ciphers. Gringotts has a set of eight different algorithms that can be used to encrypt the desired data. This utility also provides different methods for hashing as well as compression. The interface of Gringotts is not as simple as of other password Managers but still easy to use and most effective for old school bearded Unix users.

Grub is default boot loader in most Linux distributions today, at least major distros like Centos/Fedora/RedHat, Debian/Ubuntu/Mint, Arch use Grub. This makes it possible to use Grub fallback feature just out of the box. Here is example scenario.

There is remote server hosted in New Zealand and you (sitting in Denmark) have access to it over the network only (no console server). In this case you cannot afford that the new kernel makes server unreachable, e.g. if new kernel crash during boot it won’t load network interface drivers so your Linux box won’t appear online until somebody reboots it into workable kernel. Thankfully Grub can be configured to try loading new kernel once and if it fails Grub will load another kernel according to configuration. You can see my example grub.conf below:

default=saved
timeout=5
splashimage=(hd0,1)/boot/grub/splash.xpm.gz
hiddenmenu
fallback 0 1
title Fedora OpenVZ (2.6.32-042stab053.5)
        root (hd0,1)
        kernel /boot/vmlinuz-2.6.32-042stab053.5 ro root=UUID=6fbdddf9-307c-49eb-83f5-ca1a4a63f584 rd_MD_UUID=1b9dc11a:d5a084b5:83f6d993:3366bbe4 rd_NO_LUKS rd_NO_LVM rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYTABLE=sv-latin1 rhgb quiet crashkernel=auto
        initrd /boot/initramfs-2.6.32-042stab053.5.img
        savedefault fallback
title Fedora (2.6.35.12-88.fc14.i686)
        root (hd0,1)
        kernel /boot/vmlinuz-2.6.35.12-88.fc14.i686 ro root=UUID=6fbdddf9-307c-49eb-83f5-ca1a4a63f584 rd_MD_UUID=1b9dc11a:d5a084b5:83f6d993:3366bbe4 rd_NO_LUKS rd_NO_LVM rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYTABLE=sv-latin1 rhgb quiet
        initrd /boot/initramfs-2.6.35.12-88.fc14.i686.img
        savedefault fallback

According to this configuration Grub will try to load ‘Fedora OpenVZ’ kernel once and if it fails system will be loaded into good ‘Fedora’ kernel. If ‘Fedora OpenVZ’ loads well you’ll be able to reach the server over the network after reboot. Notice lines ‘default=saved’ and ‘savedefault fallback’ which are mandatory to make fallback feature working.

Alternative way

I’ve heard that official Grub fallback feature may work incorrectly on RHEL5 (and Centos 5) so there is elegant workaround (found here):

1. Add param ‘panic=5′ to your new kernel line so it looks like below:

title Fedora OpenVZ (2.6.32-042stab053.5)
        root (hd0,1)
        kernel /boot/vmlinuz-2.6.32-042stab053.5 ro root=UUID=6fbdddf9-307c-49eb-83f5-ca1a4a63f584 rd_MD_UUID=1b9dc11a:d5a084b5:83f6d993:3366bbe4 rd_NO_LUKS rd_NO_LVM rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYTABLE=sv-latin1 rhgb quiet crashkernel=auto panic=5
        initrd /boot/initramfs-2.6.32-042stab053.5.img

This param will make crashed kernel to reboot itself in 5 seconds.

2. Point default Grub param to good kernel, e.g. ‘default=0′.

3. Type in the following commands (good kernel appears in grub.conf first and new kernel is second one):

# grub
 
grub> savedefault --default=1 --once
savedefault --default=1 --once
grub> quit

This will make Grub to boot into new kernel once and if it fails it will load good kernel. Now you can reboot the server and make sure it will 100% appear online in a few minutes. I usually prefer native Grub fallback feature but if you see it doesn’t work for you it makes sense to try above mentioned workaround.

Key benefits of Mosh

• Stays connected if your IP is changed. Roaming feature of Mosh allows you to move between Internet connections and keep Mosh session online. For example, if your wifi connection changes IP you don’t need to reconnect.
• Keeps session after loosing connection. For example, if you lost Internet connection for some time, or your laptop went offline due to exhausted battery – you’ll be able to pick up previously opened Mosh session easily.
• No root rights needed to use Mosh. Unlike SSH Mosh server is not a daemon that needs to listen on specific port to accept incoming connections from clients. Mosh server and client are executables that could be run by ordinary user.
• The same credentials for remote login. Mosh uses SSH for authorization so in order to open connection you need the same credentials as before.
• Responsive Ctrl+C combination. Unlike SSH Mosh doesn’t fill up network buffers so even if you accidentally requested to output 100 MB file you’ll be able to hit Ctrl+C and stop it immediately.
• Better for slow or lagged links. Have you ever tried to use SSH on satellite link where average RTT is 600 ms or more? Wish Mosh you don’t need to wait until server replies to see your typing. It works in CLI and such programs as vi or emacs so on it makes it possible to do the job slow connections more comfortably.

Well, there are some disadvantages too:

• No IPv6 support.
• UTF-8 only.

Mosh is available for all major Linux distributions, FreeBSD and Mac OS X systems:

Ubuntu (12.04 LTS) or Debian (testing/unstable): sudo apt-get install mosh
Gentoo: emerge net-misc/mosh
Arch Linux: packer -S mobile-shell-git
FreeBSD: portmaster net/mosh
Mac OS X: mosh-1.1.3-2.pkg
Sources: mosh-1.1.3.tar.gz

Project’s website

P.S. It’s better that combination of SSH and GNU Screen.

In order to attach it to VMs or change its settings you’ll need to type in a few commands to XenServer’s CLI.

1. Connect XenServer via SSH using root rights:

ssh root@192.168.10.1 -v

2. Make sure that new NIC is attached to hardware and detected by Linux, in below command’s output you can see there are three Ethernet controllers (the last one was just attached to hardware):

[root@localhost ~]# lspci  | grep -i ethernet
10:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168B PCI Express Gigabit Ethernet controller (rev 01)
1e:00.0 Ethernet controller: Broadcom Corporation NetXtreme BCM5723 Gigabit Ethernet PCIe (rev 10)
30:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL-8139/8139C/8139C+ (rev 10)

As you can see this NIC isn’t shown in XenCenter and below command doesn’t show its UID among detected interfaces:

root@localhost ~]# xe pif-list
uuid ( RO)                  : 095abcc1-4d64-7925-200f-a91d558ec872
                device ( RO): eth1
    currently-attached ( RO): true
                  VLAN ( RO): -1
          network-uuid ( RO): 9da74476-ffcb-6824-25ad-62d46f34e252
 
uuid ( RO)                  : 555844b2-4061-47e0-52ef-01e42f182eef
                device ( RO): eth0
    currently-attached ( RO): true
                  VLAN ( RO): -1
          network-uuid ( RO): 90a0e347-9246-7ac9-c939-30983602c14e

As well as no new eth2 in ifconfig’s output

[root@localhost ~]# ifconfig     
eth0      Link encap:Ethernet  HWaddr 68:B5:99:E3:1C:56  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1953 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2475 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:201110 (196.3 KiB)  TX bytes:1929408 (1.8 MiB)
          Interrupt:19 
 
eth1      Link encap:Ethernet  HWaddr 00:30:4F:33:43:6E  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:110 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:14435 (14.0 KiB)  TX bytes:0 (0.0 b)
          Interrupt:17 Base address:0xe000

[root@localhost ~]# ifconfig eth2
ifconfig: interface eth2 does not exist

3. Solution is pretty easy – you just need to find out UUID of XenServer host to which you’d like to attach new NIC. You can do it by the following commands:

[root@localhost ~]# xe host-list 
uuid ( RO)                : c5ab0df3-440a-4164-b1a4-6febf1ff0052
          name-label ( RW): XenServer HP Proliant ML 110
    name-description ( RW): Default install of XenServer

and

[root@localhost ~]# xe pif-scan host-uuid=c5ab0df3-440a-4164-b1a4-6febf1ff0052

That’s it, from now you’ll see new NIC in XenCenter.

[root@localhost ~]# xe pif-list
uuid ( RO)                  : 095abcc1-4d64-7925-200f-a91d558ec872
                device ( RO): eth1
    currently-attached ( RO): true
                  VLAN ( RO): -1
          network-uuid ( RO): 9da74476-ffcb-6824-25ad-62d46f34e252
 
uuid ( RO)                  : 555844b2-4061-47e0-52ef-01e42f182eef
                device ( RO): eth0
    currently-attached ( RO): true
                  VLAN ( RO): -1
          network-uuid ( RO): 90a0e347-9246-7ac9-c939-30983602c14e
 
uuid ( RO)                  : 7f3b59d7-1508-835a-b268-4476bbac33d5
                device ( RO): eth2
    currently-attached ( RO): false
                  VLAN ( RO): -1
          network-uuid ( RO): 9584917b-e49a-f075-f1e0-8ba2c4a4bf02

By default XenServer can attach ISO images and make them available to VMs if ISOs are stored on a separate NFS server. In this post you’ll see how to avoid creation of NFS share and attach ISO image stored on XenServer host locally.

1. Connect to XenServer SSH service via management interface using root password:

ssh root@192.168.1.99 -v

where 192.168.1.99 is IP address of XenServer host.

2. Create directory where you will store ISO images and then exit from XenServer’s SSH.

mkdir /var/opt/xen/iso_import/ISO1
exit

3. Copy ISO images to newly created directory. I assume my readers are Linux users so you can use below command to transfer files via SSH. Btw, command is the same if you’re using OS X:

scp Downloads/your_image.iso root@192.168.1.99:/var/opt/xen/iso_import/ISO1

4. Make local ISO library available for VMs in XenServer:

xe sr-create name-label=ISO1 type=iso \
device-config:location=/var/opt/xen/iso_import/ISO1 \
device-config:legacy_mode=true content-type=iso

5. Make sure ISO_Library is attached to XenServer:

xe vdi-list

In case of success you’ll something like this in the output:

uuid ( RO)                : 025c79f8-02dc-4950-8da5-d60f4675ca77
          name-label ( RW): your_image.iso
    name-description ( RW):
             sr-uuid ( RO): 3caefbd6-8683-cc4b-e642-e3540d0fe13e
        virtual-size ( RO): 168099840
            sharable ( RO): false
           read-only ( RO): true

That’s it, you’ll see new ISO in XenCenter after this step:

WARNING: When copying ISO images to XenServer’s local filesystem keep an eye on free disk space – XenServer allocates not to much gigabytes for hypervisor itself so three or four ISO images may take all free HDD space and cause problems with systems running in VMs. Use command ‘df -h /’ to get info about free space in root filesystem.

In order to upgrade just use Update Manager that comes with Linux Mint Debian by default, you will see an update mintupdate-debian available today. If you are not Linux Mint user yet then you can download LMDE and follow instructions described in project’s blog.

ISO image with included Update Pack 4 isn’t available for download yet but is planned to be published soon.

Use the following commands to install Cinammon and Mate desktops once upgraded to Update Pack 4:

sudo apt-get install mate-desktop-environment cinammon

There are a few plugins for Nagios to monitoring BGP in Cisco. All of them fetch data from Cisco via SNMP so the first you need to do is to open access to your Cisco router from the host where Nagios is running. You can read more about this task on the web (for example here) but here are quick commands to open read only access:

snmp-server community myCommunity RO SNMP-MANAGEMENT
ip access-list standard SNMP-MANAGEMENT
 permit A.B.C.D
 deny any log

Where ‘myCommunity’ is name of SNMP community that will be used at Nagios host to retrieve data from Cisco router via SNMP, ‘SNMP-MANAGEMENT’ is name of ACL that opens access to SNMP only from IP address ‘A.B.C.D’ (replace with public IP address of Nagios host).

Once access to Cisco via SNMP is open you should add check_bpg plugin to Nagios:

cd /usr/lib/nagios/plugins
wget -O check_bgp.pl "http://exchange.nagios.org/components/com_mtree/attachment.php?link_id=1555&cf_id=30"
chmod +x check_bgp.pl

Now let’s check if Nagios host can actually get access to myCommunity at Cisco:

./check_bgp.pl -H 10.11.12.13 -C myCommunity -p 192.168.10.1

Where ’10.11.12.13′ is IP address of Cisco router and ’192.168.10.1′ IP address of BGP peer you need to get info about. In case of success you will see OK state and how long that peer is in state ESTABLISHED.

OK - 192.168.10.1 (AS12345) state is established(6). Established for 191d11h15m28s.

From this point it’s time to add commands to Nagios and make it to track BGP peer’s state constantly. Open Nagios’ commands.cfg config file and add there the following lines:

define command{
    command_name    check_cisco_bgp
    command_line    $USER1$/check_bgp.pl -H $HOSTADDRESS$ -C $ARG1$ -p $ARG2$
}

Then add these lines to services.cfg:

define service {
    use                             generic-service
    service_description             BGP_KPN
    host_name                       cisco-router-1
    check_command                   check_cisco_bgp!myCommunity!192.168.10.1
}

Then restart Nagios and check services summary page, you should see new BGP_KPN instance there and will receive an alert if this peer goes down.

Obviously you’ll need to add more services to specify all BPG peers and all Cisco routers you need to monitor in Nagios.

IPplan

IPplan (formerly known as iptrack) provides clean web interface for IP address management with wide range of features like IPv6 support, multi-language  interface, split and join of IP networks, import from routing tables and XML/CVS files, multiple user groups, overlapping detection, search, audit, triggers and much more. IPplan stores its data in databases like Postgresq, Mysql or Oracle. Moreover IPplan provides API so you can create DHCP configs (for example) based on IPplan’s database.

Documentation and Howtos: Official Documentation, Install and configure IPplan in OpenSuse, Installing IPplan.

GestióIP

GestioIP is lively maintained IPAM system available under GPLv3 license. It provides web interface for IPv4 and IPv6 tracking, allows network discovering, search, filtering, splitting/joining of IP networks, statistics, embedded IP calc and much more. I would recommend GestióIP to those who need clean and simple IPAM with basic features. Btw, Gestió in Catalan means “management”.

Documentation and Howtos: Official Documentation.

OpenIPAM

OpenIPAM is open source (GPLv3 license) IPAM software developed by Utah State University’s Department of Information Technology that comes with the following features: distributed management of IP resources by multiple users and groups, clean web interface, API, LDAP support, expiration system and more. OpenIPAM stores its data in PostgreSQL.

Documents and Howtos: Official Documentation (wiki).

NOC

NOC is Operation Support System (OSS) for ISP and content provides that comes with builtin powerful IPAM module. It provides support of IPv4 and IPv6, clean web interface, access delegation, DNS integration, search, reporting tools and a lot of other features. NOC was designed for and is used by large ISP and datacenters. It is very powerful open source software.

Documentation and Howtos: Official Documentation, NOC Blogs, NOC: Brief Introduction into IP Address Management (IPAM).

Know some other open source IPAM software? Feel free to leave a comment with its name.

LinuxScrew t is hosted at Linode cloud hosting and holds part of its static content in Amazon S3. I am user of Linode for 3 years and its performance, support, rates totally meet my needs and expectations but the only thing bothers me is rather long response time when requesting static content hosted in Linode cloud. In order to resolve this I migrated part of images and javascript files to S3 – this improved overal response time dramatically, especially for visits from Europe so it looks like I’ll stay with S3 for some time longer.

Btw, if you didn’t have a chance to try Pingdom for measuring website’s performance and monitoring it makes sense to do it now at www.pingdom.com.

In this article I’ve listed top 5 web based Linux monitoring tools which can cover almost all aspects of sysadmin’s monitoring tasks.

Nagios

This is one of the most popular web based Linux monitoring systems nowadays, actually it’s industry standard for IT infrastructure monitoring. Licensed under GPL Nagios is available for everybody free of charge and allows to monitor availability and response time of network services, usage of system resources like CPU load, RAM allocation etc., number of logged in users and many-many more. It doesn’t makes sense to list here everything that can be monitored by Nagios but its nature implies that main Nagios instance (server) collects information from either local system or Nagios clients (agents). It means you can install client software on number of Linux, BSD, Windows hosts or Cisco devices, point them to Nagios server and see states of their services or processes in one place: Nagios web based monitoring tool (see the screenshot below).

In case of any outage detected by Nagios server or any anomaly you will get an alert from Nagios. It’s important that Nagios suports wide range of alerts including e-mail, sms, chat messages and phone call notifications. Large number of official and third party plugins can extend Nagios’ functionality dramatically.

And one more thing, Nagios monitors states but it doesn’t show any graphs like network interface usage etc., that’s why it’s good habit to use Nagios with other monitoring tools listed below.

Project’s homepage: http://www.nagios.org/
Documentation and Howtos: Official Documentation, How To Monitor Remote Linux Host using Nagios 3.0, Centos Nagios Howto, Ubuntu Nagios Howto, FreeBSD Nagios Howto.

Cacti

Cacti is another web based monitoring system written in PHP and licensed under GPL. Unlike Nagios describe above Cacti was designed mainly fo the graphs — in brief, Cacti polls various services and then graphs resulting data. It uses RRDTool to build graphs so if you can some graphs in .rrd files you can easily attach them to Cacti and have everything in one place.

So you can see CPU load graphs, RAM usage, round trip time stats, bandwidth utilization and much more information collected from various hosts. As well as Nagios Cacti supports SNMP that makes it possible to monitor almost any device in your network: Linux hosts, *BSD hosts, Windows hosts, Cisco devices, Juniper equipment, voip phones, routers, switches whatever.

Meantime by default Cacti doesn’t provides alerts so you should install third party plugin (thold or others) for that or use more flexible solutions supporting alerts (like Nagios or Zabbix).

Project’s homepage: http://www.cacti.net/
Documentation and Howtos: Official Documentation, Centos/RedHat Cacti Howto, Debian SNMP+Cacti Howto, Ubuntu Cacti Howto.

Zabbix

Zabbix is enterprise class Linux monitoring system with impressive list of capabilities available out of the box. It is licensed under GPL and is written in PHP. In brief Zabbix can do the same tasks as Nagios and Cacti by default: Zabbix easily graphs monitored data and sends alerts to user in case of any problem. Using Zabbix you can create maps of the hosts, group hosts by various categories and so on.

I personally like Zabbix’s capability to track changes made into specified files, for example if /etc/password is changed at one of your 100 servers and you monitor it with Zabbix then you’ll get corresponding report about this authorized (or not!?) change.

Zabbix can collect data from remote hosts where Zabbix agent/client is running (just like Nagios). Zabbix shows various kinds of graphs including network statistics, CPU load and so on (just like Cacti). Probably Zabbix may seem rather complicated for beginners but I’d recommend to take some time and get familiar with this monitoring system.

Project’s homepage: http://www.zabbix.com/
Documentation and Howtos: Official Documentation, Ubuntu Zabbix Howto, Debian Zabbix Howto, Monitor Radius with Zabbix.

MRTG

MRTG is yet another open source monitoring tool that collects data at local and/or remote host by means of SNMP protocol. But MRTG is much more simple than Cacti, Nagios or Zabbix so it may be a good choice for small projects.

One of the most common applications of MRTG is monitoring of network interfaces, CPU, memory usage and network interfaces statistics. One of MRTG’s advantages is that it it extremely easy to deploy. Btw, MRTG was created by author of RRDTool Obi Oetiker.

Project’s homepage: http://oss.oetiker.ch/mrtg/
Documentation and Howtos: Official Documentation, Linux MRTG Howto, Advanced MRTG for Linux, Centos MRTG Howto.

Nfsen

Nfsen is open source Netflow collector and analyzer available under open source license. It differs from monitoring tools described here — Nfsen collects only network usage data and shows the interactive graphs based on that data.

I found Nfsen as the only workable open source Netwflow analyzer available for Linux. Using Nfsen you can see the graphs showing network traffic on various hosts or networks, configure alerts (for example if bandwidth usage is lower or higher than average) and what it more important to digg into collected traffic.

Let’s imagine you see traffic spike at the graph that shows that some of your host was generating some TCP traffic 12 hours ago and you wish to know what was that. Nfsen makes it possible to investigate that spike and report what was destination and source IP addresses of that traffic, what was the protocol, port numbers and how many sesstions/flows were established. None of above mentioned monitoring systems do such an investigation. Nfsen’s graphs are interactive so you can select what data you wish to see at the graph and aggregate many data sources into one graph, it’s better to understand when building protocol breakdown graphs with Nfsen.

Project’s homepage: http://nfsen.sourceforge.net/
Documentation and Howtos: Official Documentation, Nfsen and Nfdump Howto, Tracking incidents with Nfsen, Traffic Classification with Nfsen.

Bottom Line

Of course there are other web based monitoring tools for Linux available, some of them may even beat functionality of mentioned systems. If you feel that it makes sense to extend this list with other monitoring system just leave a comment here with brief description of suggested Linux monitoring system. Thank you in advance.